Privacy
What ColdRun collects, why it needs it, and who sees it.
This describes current behaviour. It is not yet a compliant privacy notice.
A notice under India's Digital Personal Data Protection Act needs a named data fiduciary, a grievance officer, stated retention periods and a consent mechanism. Those need to be decided by the operator before ColdRun processes personal data commercially. What follows is an accurate account of what the software does today.
What is collected
From businesses: company name, GSTIN, optional FSSAI number, contact person, mobile, email, city and state. For each shipment, the pickup and delivery company names, addresses and site contacts you enter.
From transport partners: company and owner name, GSTIN, PAN, business address, bank account details, mobile and email, plus uploaded copies of PAN, GST certificate, cancelled cheque and any company registration. For each vehicle, its registration number, specification, compliance expiry dates and documents. For drivers, name, mobile and licence details.
Sign-in is handled by Clerk, which holds your credentials. ColdRun stores an identifier linking your account to it, plus your email and name.
Why it is collected
Business and vehicle documents exist so that a person can verify a transport partner before they are allowed to carry anybody's goods. Without them the verification badge would mean nothing.
Shipment details exist so the right partners can be found and so the trip can be carried out. Bank details exist to settle transport partners for completed trips.
Who sees what
A transport partner sent your requirement sees the cities, date, temperature, weight, product category and vehicle requirement. They do not see your company name, addresses or site contact numbers unless and until you accept their quote.
Once you book, the partner carrying the shipment sees the pickup and delivery details they need to do the job.
Transport partner bank details and uploaded documents are visible only to ColdRun administrators, never to customers.
Where it is stored
Records are held in a PostgreSQL database. Uploaded documents and photographs are held in S3-compatible object storage. Where storage is not configured on a deployment, uploads are refused rather than silently discarded.
Notifications
Every notification the platform decides to send is recorded, including whether it was actually delivered. Where no email or messaging provider is configured, the record shows the message as skipped rather than sent.
Still to be decided
Retention periods, the named grievance officer, the process for exporting or deleting your data on request, and the treatment of documents belonging to rejected partner applications.